Abstract
Windows 11 ships with a nifty feature called Power Automate, which lets users automate mundane processes. In a nutshell, Users can build custom processes and hand them to Microsoft, which in turn ensures they are distributed to all user machines or Office cloud, executed successfully and reports back to the cloud. You can probably already see where this is going.. In this presentation, we will show how Power Automate can be repurposed to power malware operations. We will demonstrate the full cycle of distributing payloads, bypassing perimeter controls, executing them on victim machines and exfiltrating data. All while using nothing but Windows baked-in and signed executables, and Office cloud services. We will then take you behind the scenes and explore how this service works, what attack surface it exposes on the machine and in the cloud, and how it is enabled by-default and can be used without explicit user consent. We will also point out a few promising future research directions for the community to pursue. Finally, we will share an open-source command line tool to easily accomplish all of the above, so you will be able to add it into your Red Team arsenal and try out your own ideas.
Transcript
AI generated from recording.
Introduction and Motivation
00:00 Presenter: Okay, so, hi everyone. So, you can probably judge from the title, but what we’re going to do today is we’re going to show how you can use Windows executables, service accounts, and cloud services to basically power your own malware operation.
00:19 Presenter: Shortly about me, I’ve been around cybersecurity for a long time now, spent some time at, sorry.
00:34 Presenter: Thank you for that.
00:36 Presenter: So I spent a bunch of time at Microsoft on APIs, IoT, cloud.
00:42 Presenter: I’ve been doing low-code, no-code security for like three years now,
00:45 Presenter: which is weird because not many people are into it,
00:48 Presenter: but you will soon be, so that’s cool.
00:52 Presenter: I started a company around 18 months ago called Zenity
00:56 Presenter: with folks that are sitting right here.
00:58 Presenter: We’re focused on low-code, no-code security.
01:00 Presenter: And again, first time at DEFCON,
01:03 Presenter: very excited to be here, as you can probably hear.
01:05 Presenter: So thank you for coming.
01:07 Presenter: By the way, this talk is going to feature research from Ria Zilberberg,
01:11 Presenter: sitting right here, one of our researchers.
01:13 Presenter: So give him some love.
01:22 Presenter: This one is important.
01:24 Presenter: Low-code, no-code is a cool thing.
01:26 Presenter: We are very much pro the movement.
01:29 Presenter: And this talk, I will try to give you an attacker’s perspective on that.
01:33 Presenter: The reason, of course, is to make sure that this is done in a responsible way.
RPA Fundamentals and Architecture
01:38 Presenter: So what you’re going to learn today, use it to educate people around you and let’s see where it takes us.
01:48 Presenter: Okay, so I’m going to start right now.
01:52 Presenter: When I say creating or running your own malware operation, there are a bunch of things that could mean.
01:57 Presenter: So let’s figure out what exactly I’m meaning that we’re going to do today.
02:01 Presenter: So you have initial access to some victim machine.
02:05 Presenter: there’s a lot of other things that you need to do around it
02:08 Presenter: in order to really call it a malware operation.
02:11 Presenter: You need to be able to, um, okay.
02:15 Presenter: So you need to be able to go through a firewall.
02:18 Presenter: You need to be able to actually run malware on that machine
02:21 Presenter: and be able to bypass DDR.
02:23 Presenter: You need to be able to create command and control
02:27 Presenter: across that firewall and to exfiltrate data back,
02:30 Presenter: back to your, back, uh, backwards outside of the org.
02:35 Presenter: avoid detection by a bunch of enterprise tools
02:39 Presenter: that are out there in order to catch you.
02:41 Presenter: And you need to remain persistent on the actual victim machine
02:45 Presenter: when they are obviously trying to kick you out.
02:49 Presenter: All of those things are a bunch of grunt work.
02:53 Presenter: So what we’re gonna do today is we’re gonna show how
02:57 Presenter: instead of having to do all of that yourself,
03:00 Presenter: you can just focus on the initial access
03:02 Presenter: and on the last part, which is kind of having fun.
03:05 Presenter: And we’re going to try and figure out
03:08 Presenter: how we can use existing services
03:10 Presenter: to take care of all of that ops for us.
03:18 Presenter: So here’s the service that we’re going to use.
03:21 Presenter: I’m not sure if you’ve heard about RPA.
03:23 Presenter: This is basically a technology that is out there
03:26 Presenter: in every major enterprise today.
03:29 Presenter: It’s really every world.
03:32 Presenter: behind RPA is basically to take mundane processes that business users are doing, so copying
03:38 Presenter: and pasting through different softwares that they have on their machine, and basically
03:43 Presenter: automating it. And the way that it gets automated is that the users are actually emulated. So
03:50 Presenter: the user gets impersonated, they are copying the keyboard and the mouse clicks and then
03:56 Presenter: reiterating them, and that’s the way that they’re using the user’s own identity. And
04:02 Presenter: basically facilitate integration with old software that has no APIs, which makes it easier.
04:09 Presenter: So RPA is built of three main components. The first one is an agent. It sits on somebody’s laptop,
04:14 Presenter: and it emulates the user, as I’ve just mentioned. The second part is the controller, which is able
04:20 Presenter: to reach out to the machine, send some payload, the payload gets executed, and then the output gets
04:28 Presenter: routed back. And there’s a management portal which allows you to basically say, okay, here are all
04:33 Presenter: my agents, here’s the payload I’m going to send to each one of them. The key thing about this
04:38 Presenter: technology is that every part here is trusted. And what do I mean by trusted? I mean trusted by
04:43 Presenter: the EDR, trusted by network security, trusted by the SOC team. So on the agent side, there are
04:49 Presenter: executables that are signed by the vendors themselves. We’ll see that in a moment. The
04:54 Presenter: the communication, so all of the endpoints,
04:56 Presenter: all of the protocols, and the cloud services themselves.
05:01 Presenter: And there are a bunch of vendors that are
05:05 Presenter: providing these RPA solutions that, as I mentioned,
05:08 Presenter: are everywhere in the enterprise.
Microsoft Power Automate Desktop Overview
05:10 Presenter: Today, as you’ve kind of realized from the talk’s title,
05:14 Presenter: we’re gonna focus on Microsoft,
05:16 Presenter: and you’ll find out why in a moment,
05:18 Presenter: but actually everything that I’m gonna show you today
05:20 Presenter: is not specific to Microsoft.
05:21 Presenter: but it’s actually a problem,
05:25 Presenter: it’s actually inherent in the way that RPA works.
05:31 Presenter: So RPA can take care of all of the malware ops
05:36 Presenter: that I just talked about for us.
05:39 Presenter: So command and control,
05:40 Presenter: exfiltrating data outside of the org,
05:44 Presenter: avoiding defense,
05:46 Presenter: persistency, cleanup,
05:48 Presenter: but it also will be able to give us much more.
05:52 Presenter: errors, everything that’s related to kind of engineering,
05:55 Presenter: updating those agents, being able to support any type of
05:59 Presenter: platform, those are all things that the RPA vendors will do
06:03 Presenter: for us.
06:04 Presenter: So this is a living of the land attack and we’re going to live
06:07 Presenter: off the land of RPA and specifically Microsoft RPA to do
06:11 Presenter: what we want to do.
06:13 Presenter: Here’s our agenda for today.
06:14 Presenter: So we covered the motivation, next up we’re going to drill
06:18 Presenter: down a bit more into what RPA is all about.
06:21 Presenter: focused on, we’ll do a deep dive and understand how it works.
06:25 Presenter: Then I will shift gears and show you specifically
06:29 Presenter: how do you take RPA and leverage it
06:31 Presenter: to your own malware operation.
06:33 Presenter: And we’ll introduce a tool that will allow you
06:35 Presenter: to do that quickly.
06:36 Presenter: And don’t worry, we’ll also send you home
06:38 Presenter: with kind of a few things you can do
06:39 Presenter: to remain protected or protect your organization.
06:44 Presenter: Okay, so in order to understand what RPA is,
06:48 Presenter: let’s start off with a story.
06:51 Presenter: young, when I was a teenager, my friends and I used to play in a game called Tibia. Who
06:58 Presenter: knows what Tibia is? Raise your hand. Okay. That’s a weird game, weird MMORPG from a long
07:07 Presenter: time ago where basically you kind of, you level up your character, you play with other
07:12 Presenter: players, and you collaborate, but a lot of the actual time that you get, that you spend
07:19 Presenter: of that game is actually doing things like fishing. So you need to improve your fishing
07:25 Presenter: skills. In order to do that, you basically go to a pond and then you need to click. So
07:31 Presenter: you click and you get some fish and you click and you get more fish and more fish. And this
07:36 Presenter: is basically transforming clicks and virtual worms into virtual fish. This is important
07:44 Presenter: for the game but it is extremely boring. So of course as a teenager I wanted to take advantage of this.
07:53 Presenter: I wanted to basically be better than my friends and impress them. So I tried to find a creative solution
08:00 Presenter: for this to work better. I started off with physical automation. I actually looked for a picture of this.
08:08 Presenter: I couldn’t find any picture.
08:10 Presenter: I’m not sure why somebody in my family
08:12 Presenter: didn’t take the picture.
08:14 Presenter: As you can imagine, this didn’t work.
Onboarding Victim Machines Programmatically
08:17 Presenter: So the book would fall over.
08:19 Presenter: I would wake up in the morning
08:21 Presenter: and things were not as I expected.
08:25 Presenter: So I had to find a better solution.
08:28 Presenter: And I actually went with automation,
08:32 Presenter: which was basically, there was software
08:35 Presenter: that allowed me to basically record my keyboard
08:38 Presenter: and my mouse and then replay them.
08:40 Presenter: So I had this setup where I walk around the pond
08:43 Presenter: and I click on a bunch of fish
08:45 Presenter: and when I wake up in the morning, I’m leveled up.
08:49 Presenter: So this is what it looks like.
08:51 Presenter: I think you’re seeing it.
08:53 Presenter: And basically, this made me the hero of my friend.
08:55 Presenter: So this was my first kind of,
08:57 Presenter: the first moment I got some love,
09:01 Presenter: kind of across, kind of became a bit popular.
09:06 Presenter: And this is funny because this is actually the basis of RPA.
09:09 Presenter: So the same technology that I used as a kid like 20 years ago
09:13 Presenter: is being used in the enterprise today to do very serious things.
09:19 Presenter: So RPA, as a quick recap,
09:23 Presenter: it’s about replacing copy and paste integration.
09:25 Presenter: It’s a drag and drop builder.
09:27 Presenter: You’ll see it in a moment.
09:28 Presenter: And the people, and it’s used,
09:32 Presenter: the people that are building these RPA bots,
09:35 Presenter: they can be in IT, but they can also be business users.
09:38 Presenter: It emulates the user’s own actions,
09:40 Presenter: so it operates as the user with their own identity.
09:43 Presenter: There’s no way to distinguish those clearly.
09:46 Presenter: And it runs on the user’s machines.
09:48 Presenter: And on the use cases side,
09:50 Presenter: enterprises are really using it for serious things.
09:52 Presenter: So customer services, financial services,
09:57 Presenter: onboarding and offboarding, HR.
10:00 Presenter: business sensitive data.
10:02 Presenter: Now, we understand what, now that we understand what RPA is,
10:06 Presenter: let’s drill down technically into how it works
10:09 Presenter: and how, and that would also kind of lead us in the way
10:12 Presenter: that we’re looking for with our malware op.
10:16 Presenter: So, we want to use RPA for the malware operation.
10:21 Presenter: And this is where we’re gonna actually focus on Microsoft
10:24 Presenter: and this is why.
10:25 Presenter: So, Microsoft has released an RPA agent
10:27 Presenter: called Power Automate Desktop
10:30 Presenter: baked in to every Windows 11 machine.
10:32 Presenter: And by baked in I mean that if you take
10:35 Presenter: a fresh Windows machine, you’ll search for Power Automate,
10:38 Presenter: it’ll be there.
10:39 Presenter: It’s also trusted by the EDR and trusted by other EDRs as well.
Command & Control via Office Cloud
10:42 Presenter: So that’s why we’re going to focus on Microsoft today.
10:47 Presenter: Let’s start from the user’s perspective.
10:50 Presenter: So this is a fresh Windows machine, Windows 11 machine.
10:54 Presenter: Searching for Power Automate, I immediately find
10:56 Presenter: this executable.
11:00 Presenter: Let’s see if this works.
11:07 Presenter: Okay.
11:15 Presenter: Okay, it works.
11:16 Presenter: So what I’m showing you here is a quick video
11:19 Presenter: that is me setting up my connection with that RPA service.
11:25 Presenter: The third thing that I’m doing
11:27 Presenter: is actually plugging in my office account
11:30 Presenter: The crucial thing here is that I could plug in any Office account.
11:33 Presenter: So in this example I created a new organization,
11:37 Presenter: you’ll see that in a moment, and I’m plugging in my credentials
11:40 Presenter: with that organization.
11:41 Presenter: Once I plug in those credentials I get to this drag and drop
11:44 Presenter: builder with a bunch of operations that are available for me
11:47 Presenter: and then I’m going to create a low word application
11:52 Presenter: that basically writes a low word to a file on disk.
11:55 Presenter: The crucial thing here is that this thing is synced
12:00 Presenter: not anything to my cloud because I just logged in
12:03 Presenter: with my account.
12:04 Presenter: And so you’ll see in a moment when I kind of finish off
12:06 Presenter: with the demonstration here that there’s a bunch,
12:09 Presenter: so we’re seeing it now, there are a bunch of execute,
12:12 Presenter: basically bots or processes that are available for me
12:17 Presenter: to pick and choose from.
12:19 Presenter: Those are all things that I set up previously
12:23 Presenter: in my office account.
12:27 Presenter: So this is what you just saw.
12:30 Presenter: plug in your credentials, your office credentials
12:32 Presenter: to this Windows executable,
12:36 Presenter: you get all of the different payloads that you,
12:38 Presenter: or processes that you have created in an office.
12:42 Presenter: This is how it looks like,
12:45 Presenter: this is how it looks like from an architectural perspective.
12:47 Presenter: So on one side you have Power Automate, the RPA agent,
12:50 Presenter: and the other side you have Office.
12:52 Presenter: One sits in on-prem and another in cloud,
12:54 Presenter: and the reason that I’m focusing on that is that
12:57 Presenter: Microsoft of course has to be deployed everywhere
13:00 Presenter: They need to figure out how, I mean, how is this working?
13:03 Presenter: They haven’t asked for permission from anybody, right?
13:06 Presenter: It’s already there.
13:07 Presenter: So what we’re going to figure out right now, technically,
13:10 Presenter: is how is this communicating?
13:13 Presenter: So we’ll focus first on the left side,
13:16 Presenter: which is actually the local side.
13:17 Presenter: Power Automate is not one executable.
13:19 Presenter: There are a bunch of those.
13:21 Presenter: There’s one service that’s called Power Automate
13:23 Presenter: runs on the user’s own account.
13:26 Presenter: And there’s another service account that’s being created
13:30 Presenter: that runs with an executable that’s called machine runtime
13:34 Presenter: and that will be the one that’s actually in charge
13:36 Presenter: of communicating with Office Cloud.
13:38 Presenter: We’ll see that in a moment.
13:40 Presenter: There’s also, Power Automate also allows you
13:42 Presenter: to automate the browser.
13:44 Presenter: So you can basically, so through an extension
13:46 Presenter: on all popular browsers, you can change what users
13:49 Presenter: are viewing on the browsers and you can also kind of
13:51 Presenter: fetch all of the information that they have there.
13:53 Presenter: So we’ll add that to our architecture as well.
13:56 Presenter: As you can see there are kind of, there are these extensions
14:00 Presenter: all of the different browsers.
14:03 Presenter: This is the, so what you’re seeing here
14:06 Presenter: is actually that I’ve only talked about three executables
14:09 Presenter: out of about 20 that are built in to Windows 11, again.
Executing Malware Payloads and Persistence
14:15 Presenter: And you’re seeing that this is in a trusted,
14:17 Presenter: this is kind of in a trusted location.
14:20 Presenter: So there’s plenty of opportunity to do more research here.
14:25 Presenter: So if you’re looking for a challenge,
14:27 Presenter: I recommend checking this out.
14:30 Presenter: So let’s switch to another direction
14:33 Presenter: and talk about the communication.
14:35 Presenter: So of course, network boundaries have been,
14:38 Presenter: I mean people have been trying to maintain them
14:41 Presenter: for a long time and there’s a really serious question
14:44 Presenter: we should ask ourselves here,
14:45 Presenter: which is how is Microsoft able to communicate
14:47 Presenter: with Office services without having some IT admin
14:50 Presenter: open up a port somewhere.
14:52 Presenter: The way that this is done is with a neat service
14:57 Presenter: called Azure Service Bus.
15:00 Presenter: Azure Relay, basically both sides are creating
15:04 Presenter: outbound communication and so this is how the channel
15:07 Presenter: gets created.
15:09 Presenter: So the agent will reach out to Azure Service Bus
15:12 Presenter: every couple of minutes and ask for new tasks
15:15 Presenter: that it should pick up and use.
15:20 Presenter: Okay, so we’re connected, we understand how this thing
15:23 Presenter: operates, we understand that it has components
15:27 Presenter: that run as the user and components that run
15:30 Presenter: as a service account.
15:32 Presenter: The crucial thing to note right here,
15:35 Presenter: because it’s the last time I’m gonna say it,
15:36 Presenter: is that all of these things are trusted.
15:39 Presenter: The executables are trusted,
15:41 Presenter: the service accounts are trusted,
15:42 Presenter: the cloud accounts are trusted.
15:44 Presenter: They are all in the allow list that you get by default.
15:49 Presenter: Once you plug in your machine,
15:51 Presenter: this is what you’re seeing from the Office side.
15:53 Presenter: So Office provides you with kind of a nice way
15:55 Presenter: to view all of the machines that are connected to your cloud.
16:00 Presenter: run things on the laptop from the cloud.
16:04 Presenter: So you trigger, you create some sort of a payload
16:09 Presenter: and you can execute it from the cloud on some machine.
16:12 Presenter: And then you get status, you can look at history,
16:15 Presenter: you can debug things, so all of the kind of convenience
16:19 Presenter: layers that you need around it.
16:21 Presenter: The last thing that I wanna cover in terms of architecture
16:24 Presenter: is how is trust being established.
16:26 Presenter: So it’s not only about connection to the Azure service,
16:30 Presenter: bus, actually there needs to be kind of a trusted communication between the two. So when you
16:36 Presenter: register your machine with Power Automate that you saw me do a few minutes ago, there’s a private
16:42 Presenter: key that’s being created on your local machine and a public key on the cloud side. And it’s being
16:46 Presenter: used to basically encrypt a message that sends two things to the machine through Azure Service
16:53 Presenter: Bus. The first thing is local credentials. So you can run those payloads with whichever
17:00 Presenter: would like on the machine.
17:02 Presenter: And the second thing is an RPA task,
17:04 Presenter: which is the kind of the process that you would like to run.
17:07 Presenter: So again, in a summary, in a nutshell,
17:12 Presenter: this runs on the, this executes on the user’s own,
17:16 Presenter: with the user’s own credentials,
17:18 Presenter: and it constantly goes out to office
17:21 Presenter: and asking whether there’s something
17:23 Presenter: that needs to be running.
17:27 Presenter: So what we’re gonna do right now
17:30 Presenter: switch gears up until now, it was kind of theoretical.
17:34 Presenter: We’re gonna go to specifics of how you can use this setup
17:38 Presenter: to run your malware operation with Power Automate,
17:42 Presenter: Microsoft’s RPA.
17:44 Presenter: So let’s remember our wish list.
17:47 Presenter: These were the things that we wanted to accomplish
17:49 Presenter: when we started this conversation.
17:52 Presenter: So all of the things here that are around ops,
17:56 Presenter: we’ll go through each one and show how they can be done.
18:00 Presenter: we need a bit of setup.
18:03 Presenter: So what you need in order to use this is basically create,
18:07 Presenter: what I’m doing here is creating a new tenant within Microsoft.
18:10 Presenter: It’s kind of a trial version.
18:11 Presenter: You don’t need to plug in your credit cards.
18:13 Presenter: It won’t cost you anything.
18:15 Presenter: I’m creating a new organization,
18:16 Presenter: and you can see that once it is created,
18:21 Presenter: there’s a guide here which points me to how do I create,
18:25 Presenter: how do I onboard new machines here?
Automation Toolkit and Defensive Countermeasures — Part 1
18:26 Presenter: So we need to onboard Victor machines
18:29 Presenter: into my malicious Microsoft account.
18:34 Presenter: You’ve seen me do this already in the demo,
18:37 Presenter: but this was done through UI,
18:39 Presenter: which is kind of not what we’re after, right, as hackers.
18:44 Presenter: So the question is whether we can do it programmatically
18:47 Presenter: with some script.
18:49 Presenter: Fortunately, Microsoft has provided a script for us.
18:52 Presenter: Again, signed already in your Windows machines.
18:57 Presenter: this silent registration script and you provide it with your
19:03 Presenter: organization ID and again the crucial piece here,
19:06 Presenter: if you’re thinking of detections as well,
19:09 Presenter: is that you can plug in any tenant ID here.
19:12 Presenter: So of course I’m just saying okay this is my account
19:16 Presenter: and I’m pointing this agent to my malicious office tenant.
19:22 Presenter: Once I run this script, I go back to the list of machines
19:27 Presenter: and the machine is already there and you can see
19:29 Presenter: that I have the status of the machine,
19:31 Presenter: the version of the agent that’s sitting here.
19:34 Presenter: So that’s kind of cool.
19:37 Presenter: That’s basically our way to onboard victims
19:41 Presenter: to our malware operation.
19:44 Presenter: One thing that was problematic about what I just showed you
19:48 Presenter: is that this requires an admin privilege
19:50 Presenter: on the local site to do this onboarding,
19:53 Presenter: which makes this kind of boring, right?
19:56 Presenter: Fortunately, that’s not really the case.
19:58 Presenter: So we didn’t do anything special here.
20:01 Presenter: We just tried.
20:02 Presenter: It worked.
20:03 Presenter: So, well, why not?
20:05 Presenter: So you can just run this,
20:06 Presenter: and it will connect the victim’s machine to your cloud.
20:13 Presenter: Once the victim machine is registered,
20:16 Presenter: here’s what you need to do
20:18 Presenter: from the cloud to the machine.
20:23 Presenter: So you create this automation from the cloud side.
20:27 Presenter: You create a connection.
20:28 Presenter: You basically choose which machine you’re going to run on.
20:32 Presenter: You choose the local credentials.
20:34 Presenter: We saw that this is part of the payload earlier.
20:36 Presenter: And you choose a specific payload
20:37 Presenter: that you’d like to run.
20:38 Presenter: Of course you can create new payloads
20:41 Presenter: on your own machine and upload them to Windows.
20:44 Presenter: One thing that we need to figure out,
20:48 Presenter: we need to provide a user account here.
20:51 Presenter: We need to figure out what happens
20:52 Presenter: if that user is already logged in to the local account.
20:55 Presenter: What would it do to the user session?
20:59 Presenter: So again, people have already fixed this problem for us.
21:03 Presenter: RPA has two versions.
21:05 Presenter: Attended RPA, which basically runs in parallel
21:07 Presenter: to a logged in user.
21:09 Presenter: This also means I can take charge of everything
21:12 Presenter: that the user is doing.
21:13 Presenter: I can open the browser and take their cookies.
21:15 Presenter: I can do everything that the user is doing.
21:18 Presenter: Siders unattended RPA which basically creates a new session,
21:22 Presenter: runs the payload and the scars of the session.
21:25 Presenter: So we’ve seen a bunch of things.
21:29 Presenter: From our list of malware operations that we wanted to create,
21:34 Presenter: we know that we can deploy malware.
21:36 Presenter: We saw this with the basically silent registration.
21:40 Presenter: We know that this avoids defense.
21:42 Presenter: Well this was the premise, everything here is trusted.
21:45 Presenter: And we know that you can maintain persistency
21:48 Presenter: anything on the laptop, right? I only used Microsoft’s own
21:53 Presenter: executables. What we’re gonna show next is how we’ll accomplish
21:57 Presenter: all of the things that are left over. Now we’ve already kind of
22:03 Presenter: seen command and control but we only saw specific payloads so
22:08 Presenter: let’s drill down into it some more. Okay. This is how we’re
22:18 Presenter: what you can build with this RPA.
22:20 Presenter: What can you actually do on the user’s machine?
22:23 Presenter: So here’s a very quick data X field for you.
22:27 Presenter: This is an RPA flow that does the following.
22:30 Presenter: It gets as an input a file, a path on the hard disk,
22:34 Presenter: and it basically, it reads the file,
22:36 Presenter: and it sends the file content as an output of that flow.
22:40 Presenter: Again, this runs with Microsoft’s executable.
22:44 Presenter: From, and the key thing that we need to think about is
22:48 Presenter: the output actually going, so it’s going to Microsoft Cloud.
22:52 Presenter: I’m triggering it from Office, I’m logging into Office
22:54 Presenter: with my malicious account, I’m sending out this payload
22:57 Presenter: and I get in response the actual, the content of the file.
23:02 Presenter: So recalling the architecture that we saw earlier,
23:06 Presenter: let’s figure out where does the data move to make sure
23:09 Presenter: that we don’t get caught along the way.
23:12 Presenter: So this is the architecture that we saw and these are the
23:16 Presenter: three steps that are actually happening.
23:18 Presenter: building those instructions on my side
23:20 Presenter: on a malicious machine somewhere
23:22 Presenter: and I’m uploading the instructions to Office Cloud.
23:25 Presenter: Then I’m sending the payload to the machine
23:27 Presenter: through the Microsoft trusted communication channel
23:30 Presenter: and the output goes through that same channel.
23:33 Presenter: So again, completely undetected.
23:38 Presenter: So here’s another example.
23:41 Presenter: We’re gonna, so this example goes through code execution.
23:45 Presenter: So we saw that you can run specific payloads, but actually I would like to be able to run everything that I want on that laptop.
23:55 Presenter: So again, fortunately, the RPA agent provides you with the operations that allow you to execute actual code.
24:04 Presenter: So command lines, PowerShell, Python, JavaScript.
24:08 Presenter: So here’s a quick automation.
24:11 Presenter: I’m basically sending out a script,
24:14 Presenter: telling them which kind of script,
24:16 Presenter: how will it be executed,
24:18 Presenter: and then I’m exfiltrating outside the STD out and STD error.
24:24 Presenter: Actually, the problem is that when I run this,
24:27 Presenter: it gets flagged by Microsoft EDR.
24:31 Presenter: Now why does it get flagged?
24:34 Presenter: I mean it gets flagged because I ran a command line.
24:37 Presenter: It doesn’t really matter who created that command line.
24:41 Presenter: the EDR is very focused on looking on those command lines
24:44 Presenter: that are actually running.
24:47 Presenter: So you can see that I basically went out of the trusted part.
24:51 Presenter: So there’s the trusted part, the RPA agent,
24:53 Presenter: which is able to run some sort of code.
24:55 Presenter: Like here’s a piece of code, run it with this executable
24:59 Presenter: or that executable.
25:00 Presenter: And there’s the untrusted part, which is the command line.
25:03 Presenter: So the question becomes, what can we do
25:05 Presenter: only with this drag and drop primitive?
25:08 Presenter: So what kind of malware we can build only with no code?
25:13 Presenter: Actually, we can do a whole bunch of things.
25:15 Presenter: So these are all things that are provided by the RPA agent.
25:19 Presenter: Let me name some of them.
25:21 Presenter: You can use the built-in encryption function to encrypt files.
25:24 Presenter: You can trigger HTTP calls.
Automation Toolkit and Defensive Countermeasures — Part 2
25:26 Presenter: You can communicate with Active Directory in Windows services and processes.
25:29 Presenter: You can look at files and folders.
25:31 Presenter: You can automate the browser.
25:33 Presenter: You can take screenshots.
25:34 Presenter: You can automate the mouse and the keyboard.
25:37 Presenter: you get it, right? You can do basically everything. So let’s do a couple of things.
25:45 Presenter: Here’s no code ransomware for you. This one is, again, very simple. I’m iterating through the
25:54 Presenter: drive, through the local drive. I’m reading the file, encrypting that file with the
26:01 Presenter: provided an encryption function,
26:03 Presenter: and then
26:05 Presenter: stamping that file with,
26:06 Presenter: replacing it from the original.
26:10 Presenter: Here’s how this gets
26:11 Presenter: triggered from the cloud side.
26:18 Presenter: So again, very
26:19 Presenter: simple. I’m saying, here’s
26:21 Presenter: the directory I’d like to encrypt. Here’s a private
26:23 Presenter: key, and it will just
26:25 Presenter: go to the machine, send the
26:27 Presenter: payload, encrypt the file, and that’s
26:31 Presenter: here that I don’t have a lot of time so I’m gonna,
26:34 Presenter: I’m gonna skip kind of through it but as you can see
26:37 Presenter: this is being triggered from the cloud side
26:39 Presenter: and when the task gets finished and you saw that
26:42 Presenter: this already happened, I basically see it,
26:45 Presenter: I get the results on the cloud and from the machine side
26:48 Presenter: of course the files are encrypted, the EDR didn’t catch it,
26:52 Presenter: this is all being done by the Microsoft executable.
26:57 Presenter: Okay.
26:59 Presenter: Okay, here’s another one for you.
27:01 Presenter: So we know that this agent is actually creating
27:05 Presenter: a whole bunch of logs, the agent that we’re actually using.
27:08 Presenter: Because every time that it gets called,
27:11 Presenter: it writes what did it call, what exactly did it do.
27:16 Presenter: But again, looking at Microsoft documentation,
27:19 Presenter: we can figure out where these logs are being maintained
27:22 Presenter: and we can just go ahead and delete them.
27:25 Presenter: So here’s a flow to do that.
27:28 Presenter: I’ll finish off with one more.
27:31 Presenter: We talked about the browser, so here’s a quick thing
27:36 Presenter: that we can do.
27:37 Presenter: We can open the browser, we can go to some endpoint
27:41 Presenter: that we’d like to steal the user’s token from,
27:43 Presenter: and we just plug in a JavaScript shell inside of that,
27:50 Presenter: inside of that browser to basically take home the cookie.
27:54 Presenter: So there’s a quick demo for that here.
27:57 Presenter: I’m not sure I have the time, but basically,
28:00 Presenter: it’s really simple.
28:02 Presenter: What this does is it opens up the browser,
28:05 Presenter: it goes to that location, and it just runs
28:08 Presenter: the JavaScript script that I’ve mentioned.
28:12 Presenter: And fortunately, there’s a nice property here
28:15 Presenter: where you can open the browser in a minimized version,
28:18 Presenter: so the user won’t know this.
28:23 Presenter: Okay.
28:23 Presenter: Okay. So a quick recap on everything we did up until now. We saw how you can deploy malware, you can avoid detection, you can remain persistent. We saw how you can create command and control through the office cloud. We saw exfiltration and cleanup. We actually wanted to show a bunch of other things like keylogger and other things, but you can just play around with it and I’m sure you’ll find it nice.
28:50 Presenter: Um, the one thing that I’m going, the one thing that I have left for you is how do you do all of that as part of your existing arsenal? So you don’t want to be playing with UI for Office and those things. So, um, we’ve introduced this new tool for you. You can, uh, you can go ahead and use it right now. You’ll have an address in a moment.
29:12 Presenter: basically we’ve covered a bunch of things for you
29:14 Presenter: so we are handling errors,
29:17 Presenter: we are creating an HTTP endpoint
29:19 Presenter: on the malicious office side
29:21 Presenter: which you can just call
29:22 Presenter: and then you do something like you post
29:25 Presenter: okay here’s the machine I’d like to run this payload on,
29:29 Presenter: here’s the payload I’d like to run,
29:31 Presenter: here are some parameters
29:32 Presenter: and you get back all of the outputs of that process
29:38 Presenter: and all of the things that you saw here in the talk
29:41 Presenter: and other payloads as well
29:43 Presenter: are available through that tool.
29:46 Presenter: So this is available right now.
29:48 Presenter: There’s a convenience layer around it in Python.
29:51 Presenter: Let me quickly describe how it works.
29:54 Presenter: You create your Microsoft tenant.
29:58 Presenter: There are instructions on how to do that.
30:01 Presenter: Again, no credit card, free of charge.
30:03 Presenter: You run a quick script for setting up the tenant.
30:08 Presenter: register with your machines with Microsoft executables, not mine, and then you use this
30:13 Presenter: nice Python script to do things like run ransomware, run specific commands, and please feel
30:19 Presenter: free to send out pull requests with new payloads. So, we’re about done. Let’s do a quick recap.
30:30 Presenter: We saw what RPA is. We saw it’s available on every major enterprise. Check it out back home.
30:38 Presenter: We saw how it works and we saw how it can be used to power a model operation. We saw that
30:43 Presenter: you can use it with low code primitives that basically allow you to do whatever you want.
30:48 Presenter: We saw power pawn which is a new tool that you can use right now to play around with
30:52 Presenter: it and to see how it works. The last thing I’m going to do and I’ll do it very quickly
30:58 Presenter: is leave you off with a few things you can do to protect yourself, to protect your organization.
31:05 Presenter: So here’s one very, very obvious thing.
31:08 Presenter: Monitor these executables.
31:10 Presenter: So as you can see, you need to make sure that,
31:15 Presenter: basically the number one thing you need to make sure
31:18 Presenter: is that people are not registering those agents
31:20 Presenter: to a tenant that is not your own.
31:23 Presenter: You can also review, this entire talk was focused
31:28 Presenter: on using the existing tools without talking about
31:33 Presenter: the organization itself is going to use it.
31:35 Presenter: So your users might actually be using this.
31:38 Presenter: If they’re using this, there are a bunch of issues
31:41 Presenter: that can occur, and if that’s interesting for you,
31:43 Presenter: I have another talk here at 4 p.m., same room,
31:47 Presenter: so if you’re not tired of me yet, see you again.
31:50 Presenter: And there are a bunch of information that you can use here
31:53 Presenter: to learn more, Microsoft documentation,
31:55 Presenter: there’s an OWASP group that is focused on this area,
31:58 Presenter: and a bunch of blogs and content.
32:02 Presenter: Thank you very much.
32:03 Presenter: Thank you.